red hat vulnerabilities and exploits

(subscribe to this query)

3.5

CVSSv2

A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions prior to 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users.

Redhat Jboss Enterprise Application Platform 7.0 Redhat Jboss Enterprise Application Platform 7.1.0 Redhat Single Sign-on 7.2

6.5

CVSSv2

A flaw was found in the reset credential flow in all Keycloak versions prior to 8.0.0. This flaw allows an malicious user to gain unauthorized access to the application.

Redhat Keycloak Redhat Jboss Fuse 7.0.0 Redhat Openshift Application Runtimes -

5

CVSSv2

A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature. This flaw allows a specially-crafted XML file to manipulate the validation pr...

Redhat Xerces 2.12.0 Redhat Xerces

NA

A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.

NA

A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an malicious user to carry out denial of service attacks.

Redhat Jboss Enterprise Application Platform 7.3 Redhat Jboss Enterprise Application Platform 7.4 Redhat Undertow Redhat Single Sign-on 7.5.1 Redhat Single Sign-on 7.4.10 Netapp Oncommand Workflow Automation -Netapp Oncommand Insight -Netapp Cloud Secure Agent -

5.8

CVSSv2

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an malicious user to ac...

Hibernate Hibernate Orm Debian Debian Linux 9.0 Debian Debian Linux 10.0 Quarkus Quarkus Oracle Retail Customer Management And Segmentation Foundation 19.0 Oracle Communications Cloud Native Core Console 1.9.0

2 Github repositories

4

CVSSv2

It was found that while parsing the SAML messages the StaxParserUtil class of keycloak prior to 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an malicious user to determine values of system properties at the attacked system b...

Redhat Keycloak Redhat Jboss Enterprise Application Platform 6.0.0 Redhat Jboss Enterprise Application Platform 7.0.0 Redhat Jboss Enterprise Application Platform 7.1.0 Redhat Jboss Enterprise Application Platform 6.4.0

6.8

CVSSv2

FasterXML jackson-databind 2.x prior to 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).

6.8

CVSSv2

FasterXML jackson-databind 2.x prior to 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).

1 Github repository

7.8

CVSSv2

In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language ...

Apache Thrift Redhat Jboss Enterprise Application Platform 7.2.0 Oracle Communications Cloud Native Core Network Slice Selection Function 1.2.1

Get Started

« PREV 1 2 3 4 5 6 7 8 9 10 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook